When Did It Happen? Dates and Points on Every Finding

"Cheat found" means very different things if the program ran this morning or two years ago. Since version 0.0.15, every finding in the app and on the scan page shows when it happened and how many points it counted, so nobody has to guess.

The dates you can see

Each finding lists the dates its source records, with a label that says what the date means. Common ones are:

• Launched / last run: Windows recorded the program starting (from Prefetch, BAM, UserAssist and similar records).
• File created / modified: the timestamps of the file itself.
• Deleted: when the file was removed, from the file system's change journal or the Recycle Bin.
• Detected by Defender / Defender action: when Microsoft Defender found the file and what it did (for example Quarantine).
• Last seen: the most recent time any source saw the file or program.

Next to the date, the scan page shows a chip such as "3 days before the scan" or "8 months before the scan". Dates are shown in your own time zone; hover them to see UTC.

The times in square brackets in the raw scan log, like [14:02:11], are when the scan itself ran each step. They are not when the finding happened.

Why age changes the weight

A trace from long ago says less about today than one from this week. AACGUARD therefore weighs findings by the age of their last activity:

• up to 30 days old: counts fully;
• 31 to 90 days: counts half;
• 91 days to a year: counts a fifth;
• older than a year: counts a tenth.

The finding then says so in plain words, for example "Counts 50%: last activity 47 days ago". Something that is running during the scan is always current and counts fully.

When age does not help

If the Windows clock was moved back by hand or by a program, file dates can no longer be trusted. AACGUARD reads clock changes from the System and Security logs. When the clock was moved back, older traces count fully again and the finding says why: "Counts fully: last activity looks 200 days old, but the clock was moved back on …". Normal time synchronisation and catching up after sleep are ignored.

Reading "Counts X of Y points"

• Counts 40 points: the finding added 40 points to the score.
• Counts 200 of 1000 points: the finding could count 1000, but was lowered, for example because of its age or because it belongs to another game.
• Information only: shown for context, but it added nothing to the score.

Below the points you see the reason, so you can check the logic yourself. If you think the reason is wrong, use Report false positive in the app or the "Think a finding is wrong?" box on the scan page. See Reporting a false positive.

For admins

Read the dates before the verdict. A CHEAT DETECTED made of a loader that ran yesterday and a cheat file deleted an hour before the scan is a very different case from a SUSPICIOUS made of one old trace on a PC that was bought second-hand. Our guide Used and shared PCs explains the second case.